ID
VAR-201601-0674
TITLE
Fortigate firewall has SSH authentication backdoor vulnerability
Trust: 0.6
DESCRIPTION
FortiGate (FortiGate firewall) is a network firewall product launched by Fortinet, which is used to defend against network and malicious code attacks at the network layer and content layer. Fortigate firewall has SSH authentication backdoor vulnerability. Since the password of the FortiGate firewall Fortimanager_Access user is generated by a relatively simple algorithm, the attacker can directly obtain the highest authorized (root) authority for authentication after analyzing and cracking, and then control the firewall device. The subsequent attacker can use the firewall as a springboard to penetrate the internal area Network, perform operations such as information sniffing and data interception
Trust: 0.72
IOT TAXONOMY
| category: | ['ICS'] | sub_category: | - | Trust: 0.8 |
AFFECTED PRODUCTS
| vendor: | fortigate | model: | fortios | scope: | eq | version: | 5.0.0-5.0.7 | Trust: 0.8 |
| vendor: | fortigate | model: | fortios | scope: | eq | version: | 4.3.0-4.3.16 | Trust: 0.6 |
| vendor: | fortigate | model: | fortios | scope: | eq | version: | 4.3.0-4.3.16* | Trust: 0.2 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
TYPE
back door
Trust: 0.2
PATCH
| title: | Patch for Fortigate firewall has SSH authentication backdoor vulnerability | url: | https://www.cnvd.org.cn/patchinfo/show/69924 | Trust: 0.6 |
EXTERNAL IDS
| db: | CNVD | id: | CNVD-2016-00170 | Trust: 0.8 |
| db: | IVD | id: | 47D1DE3A-1E6D-11E6-8415-000C29C12F8F | Trust: 0.2 |
REFERENCES
| url: | http://seclists.org/fulldisclosure/2016/jan/26 | Trust: 0.6 |
| url: | http://www.fortiguard.com/advisory/fortios-ssh-undocumented-interactive-login-vulnerability | Trust: 0.6 |
SOURCES
| db: | IVD | id: | 47d1de3a-1e6d-11e6-8415-000c29c12f8f |
| db: | CNVD | id: | CNVD-2016-00170 |
LAST UPDATE DATE
2022-05-17T02:09:47.741000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2016-00170 | date: | 2020-03-10T00:00:00 |
SOURCES RELEASE DATE
| db: | IVD | id: | 47d1de3a-1e6d-11e6-8415-000c29c12f8f | date: | 2016-01-13T00:00:00 |
| db: | CNVD | id: | CNVD-2016-00170 | date: | 2016-01-13T00:00:00 |